Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
Computing
24/7/365 Network Uptime!
Average Rating:
Rate this article:  
Light Patch Tuesday, But New Security Advisories Emerge
Light Patch Tuesday, But New Security Advisories Emerge

By Jennifer LeClaire
October 10, 2012 10:05AM

Bookmark and Share
Besides the seven bulletins, Microsoft is publishing several security advisories. In October, KB2661254 is being switched to automatic download and will start enforcing a minimum of 1024-bit key length for certificates. Key lengths of under 1024 bits are forge-able and certificate authorities have stopped producing such certificates.
 


Microsoft on Tuesday issued seven bulletins to patch 20 vulnerabilities. Only one patch is critical. The rest are important. But despite the light cycle, IT admins can expect more Microsoft-related work in October.

Andrew Storms, director of security operations for nCircle, said Microsoft is re-releasing a number of patches this month -- in addition to the seven bulletins released as part of the regular patch Tuesday schedule and Monday's Adobe Flash update distributed to Windows 8 users via Windows Update.

Patch Re-Release

"These patches were released earlier this year and have to be re-released due to clerical error with the code signing process at release time. We're also seeing a re-release of an XML Core Services for Windows 8 users, a preventative measure to protect users against potential malicious use of MSXML," Storms told us.

As Storms sees it, the good news is that IT admins don't have to patch Internet Explorer this month since routine fixes were bundled into last month's out-of-band update and, with one exception, the other fixes are fairly tame.

"The RTF bug in Microsoft Word warrants special attention since users can be exploited simply by previewing a malicious RTF file in Outlook," Storms said. "Security teams should prioritize, distribute and install this fix as soon as possible."

Patch this First

We also asked Wolfgang Kandek, CTO of Qualys, for his insights into Microsoft's monthly release. He told us the "critical" bulletin fixes two vulnerabilities in Microsoft Word and applies to all versions of Microsoft Office.

"It addresses a vulnerability that can be exploited via a malicious RTF formatted e-mail through the Outlook Preview pane without having to open the e-mail," Kandek said. "Since the development complexity of an attack against this vulnerability is low, we believe this vulnerability will be the first to have an exploit developed and recommend applying the MS12-064 update as quickly as possible."

New Security Advisories

Besides the seven bulletins, Microsoft is publishing several security advisories. In October, KB2661254 is being switched to automatic download and will start enforcing a minimum of 1024-bit key length for certificates. Key lengths of under 1024 bits are forge-able and certificate authorities have stopped producing such certificates for several years now, he said.

"KB2749655 is a new advisory and explains a problem in Microsoft's code-signing infrastructure. During the three months in the summer of 2012, a number of binary files in Microsoft Security Bulletins were signed in a flawed way that will lead to their loss of validity, causing them to stop working in January 2013," Kandek said.

"To solve the problem, Microsoft will publish new versions of the affected bulletins, and organizations will need to reinstall the affected updates. This month the updated packages are MS12-053, MS12-054, MS12-055 and MS12-058."
 

Tell Us What You Think
Comment:

Name:

Jamos:

Posted: 2012-10-11 @ 7:22am PT
This patch breaks ICS.



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Computing
1.   Canada Says China Hacked Gov't
2.   MacBook Pros Get Update, Price Cut
3.   China Puts Microsoft Under the Lens
4.   Dell, BlackBerry Downplay Threat
5.   Cloud Wars: AWS vs. Microsoft, IBM


advertisement
Amazon Intros Zocalo Storage Service
Online storage and sharing for business.
Average Rating:
China Puts Microsoft Under the Lens
Official anti-monopoly probe launched.
Average Rating:
Dell, BlackBerry Downplay Threat
Say Apple-IBM alliance can't hurt them.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Canadian Government Charges China With Cyberattack
The government of Canada is not happy with China. Canadian officials have accused "a highly sophisticated Chinese state-sponsored actor" of launching a cyberattack on its National Research Council.
 
Researchers Working To Fix Tor Security Exploit
Developers for the Tor privacy browser are scrambling to fix a bug revealed Monday that researchers say could allow hackers, or government surveillance agencies, to track users online.
 
Wall Street Journal Hacked Again
Hacked again. That’s the story at the Wall Street Journal this week as the newspaper reports that the computer systems housing some of its news graphics were breached. Customers not affected -- yet.
 

Enterprise Hardware Spotlight
Apple Updates MacBook Pros, Cuts Prices Up to $100
The popular MacBook Pro laptop line just got an update and a price cut of as much as $100. The MacBook Pro with Retina display now includes faster processors and double the memory.
 
Dell, BlackBerry Not Sweating Apple-IBM Alliance
IBM's recent move to partner with Apple to sell iPhones and iPads loaded with corporate applications has excited investors in both companies, but two rivals say they are unperturbed for now.
 
Watson Gets His First Customer Service Gig
Since appearing on Jeopardy, IBM's Watson supercomputer has been making a living using his super-intelligent knowledge base for business verticals. Now, Watson's been hired for his first customer service job.
 

Mobile Technology Spotlight
Virgin Mobile Offers Custom Smartphone Plans
As the wireless carrier wars continue heating up, Virgin Mobile just threw the customization coal onto the fire. The firm has debuted a no-annual-contract plan with rates based on individual use.
 
Collaboration Provider Asana Revamps Mobile App
Asana, a collaboration software provider started by a Facebook founder, is now out with a rebuilt native iOS mobile app. It replaces one that even the company admits was not up to par.
 
Android 'Fake ID' Puts Millions of Users at Risk
Having this fake ID is nothing to brag about, even if you are a minor. The “Fake ID” Android flaw drops malware into smartphone apps. It can steal credit card data and even take over your device.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.